One intrusion at Kestrel Logistics, worked through real evidence. Each technique links to the SANS course that teaches it.
Kestrel Logistics incident: Seventeen challenges from one intrusion, from recon on the web shop to data leaving the building, plus a walkable office with intruder alerts.
Agents: llms.txt, MCP at https://sans.each.quest/mcp. Hosted on each.quest.